fix: use relative workflow paths in SARIF output

[woodruffw]

Fixes #57.

Example single SARIF location output with this change:

{
  "logicalLocations": [
    {
      "properties": {
        "symbolic": {
          "annotation": "does not set persist-credentials: false",
          "name": "artipacked.yml",
          "route": {
            "components": [
              {
                "Key": "jobs"
              },
              {
                "Key": "vulnerable-1"
              },
              {
                "Key": "steps"
              },
              {
                "Index": 0
              }
            ]
          }
        }
      }
    }
  ],
  "message": {
    "text": "does not set persist-credentials: false"
  },
  "physicalLocation": {
    "artifactLocation": {
      "uri": ".github/workflows/artipacked.yml",
      "uriBaseId": "%SRCROOT%"
    },
    "region": {
      "endColumn": 80,
      "endLine": 37,
      "snippet": {
        "text": "name: Checkout\n        uses: actions/checkout@v4\n\n      # NOT OK: upload-artifact archives entire repo, including persisted creds"
      },
      "sourceLanguage": "yaml",
      "startColumn": 9,
      "startLine": 34
    }
  }
}

(Observe that logicalLocations is still just the filename, but physicalLocations contains the appropriate relative path.)